Feature/symlinks

[erik-dunteman]

Summary by cubic

Intercepts execve and rewrites short symlink paths so shell commands run against the sandbox overlay. Adds a Symlinks manager integrated with the Supervisor to enable exec of COW/tmp paths and clean up on shutdown.

• New Features

  • Execve handler routes paths: passthrough continues; /proc denied; /sys blocked; COW/tmp paths executed via short symlinks written into guest memory.
  • Symlinks (/tmp/.b<uid_prefix>) point to overlay targets and are removed on supervisor deinit.
  • Guest now execs "/bin/sh -c " under seccomp; envp is empty.
  • Node SDK: runCmd takes a command string; simpler arg parsing; tests run multiple commands.

• Refactors

  • Exponential backoff for pidfd_getfd polling.
  • Supervisor logs boot duration; main uses std.process.Init.
  • Registered execve handler in syscall table; moved set_tid_address to passthrough.

^{Written for commit 9cf2305. Summary will update on new commits.}